Skip to content

feat: improve SDP security, yield withdrawals, payout recovery, and payment events - #1077

Merged
ONEONUORA merged 1 commit into
Fracverse:masterfrom
Johnsmichael150:master
Sep 25, 2026
Merged

feat: improve SDP security, yield withdrawals, payout recovery, and payment events#1077
ONEONUORA merged 1 commit into
Fracverse:masterfrom
Johnsmichael150:master

Conversation

@Johnsmichael150

@Johnsmichael150 Johnsmichael150 commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR implements:

Changes

SDP Payload Relay Security (#939)

  • Add administrative message signing in backend/src/services/stellar.rs
  • Generate signatures for SDP relay payloads
  • Validate incoming webhook signatures
  • Reject invalid or missing signature headers

Yield Vault Withdrawals (#970)

  • Implement share redemption in yield_vault
  • Validate user share balance
  • Calculate the underlying asset amount
  • Burn redeemed shares
  • Transfer the resolved asset amount to the user's Stellar wallet
  • Respect the contract's admin pause state

Mass Payout Recovery (#979)

  • Add an administrator-only recovery/refund function
  • Validate administrator authorization
  • Allow recovery of accidentally sent/stuck token balances
  • Transfer recovered balances to the treasury
  • Emit appropriate recovery events

Social Payment Events (#967)

  • Fetch registered usernames from UserRegistry
  • Include sender and receiver usernames when available
  • Update SocialPaymentEvent topics/data accordingly
  • Preserve address information when usernames are unavailable
  • Add tests for registered and unregistered users

Testing

  • Test valid and invalid SDP signatures
  • Test yield withdrawal balances, share burning, and transfers
  • Test unauthorized and authorized payout recovery
  • Test payment events with and without registered usernames
  • Run the existing contract and backend test suites
  • Verify existing payment and vault flows remain unaffected

Scope

Changes are limited to the specified backend and contract modules and their associated tests.

Issues Closed

Closes #939
Closes #970
Closes #979
Closes #967

@johnsmccain
feat(backend): add SDP payload signing and webhook signature validati…
3f70892 
…on (Fracverse#939)

- Add sign_sdp_payload() using HMAC-SHA256 to authenticate outbound SDP requests
- Add verify_sdp_webhook() for constant-time validation of inbound webhook callbacks
- Both functions use hmac 0.12 + sha2 + hex, already present in Cargo.toml
- 6 unit tests cover: round-trip, tampered body, wrong secret, malformed hex,
  whitespace tolerance, and determinism
@drips-wave

drips-wave Bot commented Sep 25, 2026

Copy link
Copy Markdown

@Johnsmichael150 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

ONEONUORA
ONEONUORA approved these changes Sep 25, 2026
View reviewed changes

@ONEONUORA ONEONUORA left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great job @Johnsmichael150

@ONEONUORA
ONEONUORA merged commit 2a6925a into Fracverse:master Sep 25, 2026
10 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment